go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON
Moderate severity
GitHub Reviewed
Published
Jun 15, 2021
to the GitHub Advisory Database
•
Updated Aug 30, 2023
Description
Published by the National Vulnerability Database
Jun 10, 2021
Reviewed
Jun 14, 2021
Published to the GitHub Advisory Database
Jun 15, 2021
Last updated
Aug 30, 2023
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
References